Live › vulnerability › CVE-2026-118376
Go to dashboardWeKnora before 0.8.2 fails to recognize NAT64-prefixed IPv6 addresses that point at internal hosts, so its URL fetching treats them as public. An authenticated user can make the server fetch internal services or cloud metadata endpoints through the web_fetch tool or URL-based knowledge import.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 03:31 UTC. All times on this page are UTC.
Teams that self-host WeKnora below 0.8.2 and let users add URLs through web_fetch or URL-based knowledge import are exposed. Instances where only trusted administrators can submit URLs, or where the host has no reachable internal services or cloud metadata, carry less risk. Deployments that already run or later are not affected.
0.8.2No product ranges from the sources yet.
0.8.2.0.8.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that misclassifies NAT64-prefixed IPv6 addresses as public. Authenticated attackers can supply URLs resolving to NAT64 encodings of internal addresses via web_fetch or URL-based knowledge import to reach internal services or cloud metadata endpoints.
This page as .md · .json · in your agent: get_signal("CVE-2026-118376")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.